Security

• Your contracts are walled off from every other account, enforced at the database layer.
• Uploaded documents are only served through a link that lasts a few minutes, and only to people in your organization who may see that contract.
• Only structured terms go into the benchmark pool — never your documents, your company name or your notes. Product, price, term and caps kept as data; seats, signing date and notice grouped or rounded.

Every connection to Proquri uses HTTPS, and browsers are told to use nothing else, on every Proquri address (HSTS).

Every night, encrypted on our server before they leave it, then stored off-site, where each backup is written once and never overwritten. Every month a backup is restored into a throwaway copy, to prove it can be.

• The database's administration interface can't be reached from the internet.
• Our own staff tools sit behind two separate sign-ins.
• The server accepts key-based logins only, never a password, and a network firewall lets through web traffic and that login, nothing else.
• Every deploy backs up the database first, and only completes once the new version passes its health checks.
• Errors, uptime and background jobs are monitored, and alert us when something fails.

To read your contract and to answer your questions in the AI Deal Copilot, its text is processed by the AI providers named in our Privacy Notice, which says who they are, where they process it and on what terms.

Real prompt-injection and cross-tenant attacks are scripted against a running copy of Proquri, and rerun whenever a change touches those defences.